CyberRota Analysis
AI-GeneratedNLTK versions prior to 3.10.3 are vulnerable due to inadequate validation of JVM options in the java() function, allowing attackers to inject harmful JVM flags. This flaw can lead to arbitrary code execution, posing a critical risk to systems utilizing affected Java applications. Organizations using NLTK should prioritize immediate updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary code execution.
Related CVEs
Other vulnerabilities affecting the same vendor(s)